Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck
CVE-2026-72821Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
Medium 5.4
In plain English
A medium-severity cross-site scripting in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 85.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- GitHub Security Advisory (GHSA-5xv4-g337-2pg7) vendor-advisory
- VulnCheck Advisory: Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle third-party-advisory